Editing Custom Application Detectors

Use the following procedure to modify custom application detectors.

Procedure

Step 1

Select Policies > Application Detectors.

Step 2

Click Edit ( edit icon ) next to the detector you want to modify. If View ( View button ) appears instead, the configuration belongs to an ancestor domain, or you do not have permission to modify the configuration.

Step 3

Make changes to the detector as described in Configuring Custom Application Detectors.

Step 4

You have the following saving options, depending on the state of the detector:

To save an inactive detector, click Save.
To save an inactive detector as a new, inactive detector, click Save as New.

To save an active detector and immediately start using it, click Save and Reactivate.

Caution

Saving and reactivating a custom application detector immediately restarts the Snort process without going through the deploy process. The system warns you that continuing restarts the Snort process on all managed devices and allows you to cancel. Whether traffic drops during this interruption or passes without further inspection depends on how the target device handles traffic. See Snort Restart Traffic Behavior for more information.

Caution

Saving and reactivating a custom application detector immediately restarts the Snort process without going through the deploy process. The system warns you that continuing restarts the Snort process and allows you to cancel; the restart occurs on any managed device in the current domain or in any of its child domains. Whether traffic drops during this interruption or passes without further inspection depends on how the target device handles traffic. See Snort Restart Traffic Behavior for more information.

To save an active detector as a new, inactive detector, click Save as New.